JAAS is a set of packages that augments the core Java 2 platform with the means to authenticate and enforce access controls upon users. JAAS is a feature included in most J2EE-compliant application servers and was mandated by the J2EE 1.3 Specification.

y tried it out for themselves, so I think I can clear it up pretty easily. The fact is, if you based your opinion of JSF on its admittedly extensive specification -- with all its lifecycle diagrams and pictures -- then the technology could easily scare th